Suspected Cross-Site Scripting (XSS) found in subject

 1name: "Suspected Cross-Site Scripting (XSS) found in subject"
 2description: "This rule detects Cross-Site Scripting (XSS) attempts within email subjects. It bypasses messages from highly trusted domains unless they fail authentication. However, the rule remains flexible, triggering even for trusted domains when emails are sent from Google Groups, ensuring thorough protection against potential threats while minimizing false positives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // subject contains suspected cross site scripting
 8  and regex.icontains(subject.subject,
 9                  '(?:[<]|%3c|\\u003c|\\x3c|&[lg]t;|&n[vw][lg]t;)\/?(?:script(?:\s*/?\s*src\s*=)?|iframe|embed|object|style|form|meta|link|svg|img|audio|video|source|body|input|textarea|select|noscript|/?title|/?textarea|/?style|/?template|/?noembed)',
10                  // constructor chain pattern
11                  'constructor\.constructor|\[\s*constructor\s*\]|\.__proto__|\[constructor\]'
12  )
13  
14  // and contains html or url encoded strings, hex escaped strings, opening or closing html tags, or escaped non word characters
15  and // subject contains common event handlers
16   regex.icontains(subject.subject,
17                   '\b(?:on(?:abort|blur|change|click|dblclick|error|focus|load|mouse(?:over|out|move|down|up)|key(?:down|up|press)|reset|select|submit|unload)|srcdoc|src\s*=)',
18                   // subject contains javascript funcitons
19                   '\b(?:javascript|eval|settimeout|setinterval|document\.(?:cookie|write|location|createElement|body|appendChild)|fetch|constructor|__proto__|prototype|getScript)\b'
20  )
21  and regex.icontains(subject.subject,
22                      // Pattern 1: Quote followed by various special characters in encoded/literal forms:
23                      // - < > angle brackets (%3C, %3E, literal, &lt;, &gt;)
24                      // - quotes (&quot;, &apos;)
25                      // - parentheses (&lpar;, &rpar;)
26                      // - curly braces (&lcub;, &rcub;)
27                      // - square brackets (&lsqb;, &rsqb;)
28                      // - equals sign (&equals;)
29                      // - forward/backward slashes (&sol;, &bsol;)
30                      // - colon (&colon;)
31                      // - semicolon (&semi;)
32                      '[\x27\x22](?:%3[CE]|[<>]|&(?:lt|gt|quot|apos|[lr](?:par|cub|sqb)|equals|[bs]ol|colon|semi)\x3b)',
33                      // Pattern 2: Encoded/special characters followed by quote
34                      // Same as above but in reverse order - special chars followed by quote
35                      '(?:%3[CE]|[<>]|&(?:lt|gt|quot|apos|[lr](?:par|cub|sqb)|equals|[bs]ol|colon|semi)\x3b)[\x27\x22]',
36  
37                      // Pattern 3: Hexadecimal or decimal HTML entities with semicolon
38                      // e.g., &#x27; (hex) or &#39; (decimal)
39                      '&#[xX]?[a-f0-9]+;',
40  
41                      // Pattern 4: Raw decimal HTML entities
42                      // e.g., &#60 (without semicolon)
43                      '&#\d+',
44  
45                      // Pattern 5: URL encoded characters
46                      // e.g., %3C for <, %3E for >, %22 for ", %27 for '
47                      '%[a-f0-9]{2}',
48  
49                      // Pattern 6: Unicode/hex escapes
50                      // e.g., \u003C for <, \x3C for 
51                      '\\[xXuU][a-f0-9]{4}',
52                      // New patterns for this type of payload
53                      '</[^>]+/[^>]+>', // Matches closing tags with slash delimiters
54                      '//[^"\x27>\s]+', // Matches protocol-relative URLs
55                      'xss\.report', // Specific known XSS domains
56                      '/\*|\*/|\-\->', // comment chars (/*, */, -->)
57  
58  )
59  
60  // negate highly trusted sender domains unless they fail DMARC authentication
61  and (
62    (
63      sender.email.domain.root_domain in $high_trust_sender_root_domains
64      and (
65        any(distinct(headers.hops, .authentication_results.dmarc is not null),
66            strings.ilike(.authentication_results.dmarc, "*fail")
67        )
68        or (
69          strings.icontains(sender.display_name, "via")
70          and any(headers.hops,
71                  any(.fields,
72                      .name == "List-ID"
73                      and strings.ends_with(.value,
74                                            strings.concat(sender.email.domain.domain,
75                                                           ">"
76                                            )
77                      )
78                  )
79          )
80        )
81      )
82    )
83    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
84  )  
85attack_types:
86  - "Credential Phishing"
87tactics_and_techniques:
88  - "Evasion"
89  - "Scripting"
90detection_methods:
91  - "Content analysis"
92  - "Sender analysis"
93id: "8a946cfa-58ea-59c5-9726-94a1892b5556"